Configuring an Unspecified S7 Connection: S7-1515 GET/PUT to a SIMATIC S7-300

An unspecified S7 connection is the only path to GET or PUT data into an S7-300 CPU whose project you cannot modify, when the calling controller is an S7-1500 (for example, an S7-1515 / S7-1515-2 PN). The configuration lives entirely in the S7-1500 project; the S7-300 side stays untouched. This article documents the exact TIA Portal procedure, the TSAP pairing rules, the 160-byte PUT/GET ceiling on the S7-300 side, and the field-proven workaround that turns a single failed 544-byte transfer into a working multi-block GET burst.

1. Why an "Unspecified" Connection Is Required

When the partner PLC is outside the TIA Portal project — physically remote, third-party, or sealed — the connection cannot be resolved by reference to the partner's interface description in the Devices & Networks editor. Instead, you create the connection on the S7-1500 side and leave the partner field blank (or marked as "Unspecified"). The local CPU opens the ISO-on-TCP transport and uses the configured TSAPs to find the partner CPU's communication resource on the wire.

According to the TIA Portal help for Unspecified connections (S7-300, S7-400, S7-1500), the unspecified connection can ride on ISO-on-TCP, ISO transport, or TCP. ISO-on-TCP (RFC 1006) is the default for S7 communication and the only transport supported by the GET/PUT blocks. The transport is selected per-connection in the inspector under "Connection mechanisms."

2. Prerequisites

1. Engineering tool: TIA Portal V15.1 or later (V16, V17, or V18 strongly recommended). Earlier versions lack the modern block interface for GET/PUT on S7-1500.
2. S7-1500 firmware: V2.0 minimum for GET/PUT, V2.5+ recommended. Check in Online & Diagnostics > CPU Information.
3. S7-300 CPU: Any PN-enabled CPU (CPU 315-2 PN/DP, CPU 317-2 PN/DP, CPU 319-3 PN/DP, or older CPU 31x with CP343-1).
4. Network: Both controllers must share an IP subnet reachable without NAT. The integrated PROFINET interface X1 of the S7-1515 must be in the same subnet as the S7-300's PROFINET interface (or its CP).
5. S7 connection resource count: S7-300 CPUs have a hard cap on simultaneous S7 connections. CPU 315-2 PN/DP provides 16 resources, CPU 317-2 PN/DP provides 32, and CPU 319-3 PN/DP provides 32. Older CPU 312/314 variants support only 4–8. Verify headroom before commissioning.
6. Access rights: No PUT/GET security is enabled on the S7-300 (or it has been disabled in the CPU properties under Protection & Security > Connection mechanisms > Permit access with PUT/GET communication from remote partner).
7. Target DB must exist and be non-optimized (or be optimized and known to the remote partner) on the S7-300. Optimized blocks cannot be addressed by absolute address from outside.

3. S7 Communication Data Length Limits — The 160-Byte Ceiling

This is the single most common reason a 544-byte GET fails with a status like 0x0002 / W#16#0002 or W#16#8082. The maximum user-data payload of a PUT or GET block depends on the partner CPU, not the calling CPU, because the partner's communication resource imposes the fragmentation rule.

When you request 544 bytes, the S7-300 returns NAK and the GET status on the S7-1515 reflects "connection not established" or "resource unavailable" because the partner cannot honor the requested length. Breaking the same range into 160-byte chunks (or smaller) restores reliable operation.

4. Step-by-Step: Configuring the Unspecified Connection in TIA Portal

4.1 Insert the Connection

1. Open the S7-1500 station in Devices & Networks.
2. Click the Connections button in the toolbar.
3. Choose S7 Connection as the type.
4. Click the S7-1500 CPU's PROFINET interface; drag a connection line out and drop it on the same interface (or any blank area) — selecting the same interface on both ends produces an "unspecified" partner.

4.2 Set the Local Interface and Address

In the connection's Properties > General tab, confirm the Local endpoint points to the S7-1500's PROFINET interface X1. The IP and subnet mask are inherited from the device configuration.

4.3 Set the Partner Endpoint

Under Partner, leave the partner station empty. Configure the partner IP address directly:

• Address: e.g., 192.168.0.42 (the S7-300's PN interface or CP343-1 IP).
• Connection mechanism: ISO-on-TCP (default).
• Port: leave blank (S7 selects 102 automatically).

4.4 Configure the TSAP Pair

TSAPs are the single largest source of failed connections. The format for an S7 endpoint is two bytes — typically 03.xx where the high byte encodes the connection resource class and the low byte encodes the rack/slot of the partner's communication interface.

A mismatched or omitted partner TSAP produces STATUS = W#16#8082 ("connection not established") on the GET, even though the IP is reachable. Siemens's application note "S7 Communication between SIMATIC S7-1500 and SIMATIC S7-300" walks through this TSAP dialog in detail.

4.5 Compile and Download

Compile the S7-1500 station (Hardware + Software) and download the connection configuration. The connection does not establish until a PUT, GET, USEND, BSEND, or a configured Establish connection actively attribute triggers it. TIA Portal's Online & Diagnostics > Connections table on the S7-1500 then shows the live state.

5. GET Instruction Configuration on the S7-1500

Open the S7-1500 program and drop an instance of the GET block (path: Instructions > Communication > S7 Communication > GET). In TIA Portal V15.1+, the block has the following inputs:

5.1 Minimal Sample ST Snippet

// Trigger GET on rising edge of a boolean tag
IF "Trigger_GET" AND NOT "Trigger_GET_Old" THEN
    "GET_DB246_318" (REQ := TRUE,
                     ID  := 16#0001,                    // connection ID from inspector
                     ADDR_1 := P#DB246.DBX318.0 BYTE 160, // partner pointer
                     RD_1   := P#DB200.DBX0.0  BYTE 160, // local receive buffer
                     CONT   := TRUE);                   // keep connection alive
END_IF;
"Trigger_GET_Old" := "Trigger_GET";

// Evaluate the job
IF "GET_DB246_318".DONE THEN
    "Get_Ok" := TRUE;
    "Get_Busy" := FALSE;
ELSIF "GET_DB246_318".ERROR THEN
    "Get_Error_Code" := "GET_DB246_318".STATUS;
    "Get_Ok" := FALSE;
ELSE
    "Get_Busy" := TRUE;
END_IF;

6. Handling the 160-Byte Limit: Multi-Block GET Strategy

When the data exceeds 160 bytes, segment the read into contiguous ranges and chain the calls. The pattern below covers the original 544-byte payload (16 strings × 32 bytes starting at DB246.DBX318.0) using four GET calls of 136 bytes each.

// Index 0..3 maps to offsets 0, 136, 272, 408
CASE "i_Segment" OF
    0: "GET_1" (REQ := "Trigger_GET", ID := 16#0001,
                ADDR_1 := P#DB246.DBX318.0  BYTE 136,
                RD_1   := P#DB200.DBX0.0    BYTE 136,
                CONT   := TRUE);
    1: "GET_2" (REQ := "Trigger_GET", ID := 16#0001,
                ADDR_1 := P#DB246.DBX454.0  BYTE 136,
                RD_1   := P#DB200.DBX136.0  BYTE 136,
                CONT   := TRUE);
    2: "GET_3" (REQ := "Trigger_GET", ID := 16#0001,
                ADDR_1 := P#DB246.DBX590.0  BYTE 136,
                RD_1   := P#DB200.DBX272.0  BYTE 136,
                CONT   := TRUE);
    3: "GET_4" (REQ := "Trigger_GET", ID := 16#0001,
                ADDR_1 := P#DB246.DBX726.0  BYTE 136,
                RD_1   := P#DB200.DBX408.0  BYTE 136,
                CONT   := TRUE);
END_CASE;

Step the i_Segment variable when each DONE arrives. With a typical round-trip of 30–80 ms per call, 544 bytes complete in roughly 150–350 ms — fast enough for any non-motion control loop.

7. Common Status Codes and Their Meanings

8. Verifying the Connection

1. From TIA Portal, connect Online to the S7-1515.
2. Open Online & Diagnostics > Connections. The newly created connection must show state Established.
3. Trigger a GET and watch the STATUS output. A successful call shows 0000 on DONE.
4. Open the local DB200 in the watch table; verify the bytes match the S7-300 source bytes (use the S7-300's Monitor & Force on DB246 to confirm the source data).
5. Repeat for each segment in the chained GET strategy.

9. Troubleshooting Matrix

10. Edge Cases and Field-Proven Caveats

• Optimized DBs on the S7-300 side reject absolute-byte addressing. If the S7-300 project cannot be modified, ask the partner whether DB246 is non-optimized (standard access). If they cannot confirm, the GET will fail with 8090.
• Concurrent connections on the S7-300: CPU 312 IFM supports 4 S7 connections total. PG, HMI, and OPC UA traffic may exhaust the pool before the S7-1500 GET ever opens. Check PLC > Operating Mode > Rack Status > Communication Resources in STEP 7 V5.x or equivalent in TIA.
• CP343-1 vs integrated PN: With a CP343-1, the integrated PN port is not usable for S7 connections — the TSAP must target the CP's slot, not the CPU slot. Slot is configured in the CP's hardware properties.
• Firewall/NAT: ISO-on-TCP cannot traverse NAT. If the two controllers are on different subnets joined by a routed path, a CP343-1 Lean with routing or a S7 router is required.
• Firmware drift: S7-300 firmware V2.x behaves identically for PUT/GET, but V3.x CPUs add an access-protection bit that defaults to "deny remote PUT/GET" in some images. Always verify on a fresh install.
• S7-1500 firmware V2.5+ on the local side lifts the local PUT/GET ceiling to 64 KB, but the partner's 160-byte ceiling remains. The local relaxation does not change how much data the S7-300 will fragment.

11. FAQ